Executive brief
Open WebUI, a popular interface for interacting with AI models, contains a flaw where users can bypass administrative restrictions to access any configured AI model. This allows unauthorized users to use expensive or restricted models, potentially leading to significant financial costs or service outages due to exhausted API limits. While it allows unauthorized model usage, it does not directly expose private workspace data like system prompts or knowledge bases.
Technical details
The /responses endpoint in the OpenAI router component fails to enforce per-model access control, validating only that a user has a valid session via get_verified_user. This contrasts with the primary generate_chat_completion endpoint, which correctly checks model ownership, group membership, and AccessGrants. An attacker with basic authenticated access can send a POST request to /api/openai/responses with an arbitrary model ID to bypass cost-tier restrictions or team-based assignments. This can lead to Model Denial of Service (OWASP LLM04) through resource exhaustion or Model Theft (OWASP LLM10) of fine-tuned models. The vulnerability is addressed in version 0.9.0.
Affected products
- Open WebUI open-webui <= 0.8.12
Timeline
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-08: patched: Fix merged via PR 23481
- 2026-05-15: other: NVD published CVE-2026-44556